1. 配置WebSecurityConfiguration
/** Copyright (c) 2020 mental4cloud Authors. All Rights Reserved.** Licensed under the Apache License, Version 2.0 (the "License");* you may not use this file except in compliance with the License.* You may obtain a copy of the License at** http://www.apache.org/licenses/LICENSE-2.0** Unless required by applicable law or agreed to in writing, software* distributed under the License is distributed on an "AS IS" BASIS,* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.* See the License for the specific language governing permissions and* limitations under the License.*/package com.aiplus.mental.auth.config;import com.aiplus.mental.auth.support.core.FormIdentityLoginConfigurer;
import com.aiplus.mental.auth.support.core.MentalDaoAuthenticationProvider;
import org.springframework.context.annotation.Bean;
import org.springframework.core.annotation.Order;
import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
import org.springframework.security.config.annotation.web.configurers.HeadersConfigurer;
import org.springframework.security.config.annotation.web.configurers.RequestCacheConfigurer;
import org.springframework.security.web.SecurityFilterChain;/*** 服务安全相关配置** @author lengleng* @date 2022/1/12*/
@EnableWebSecurity
public class WebSecurityConfiguration {/*** spring security 默认的安全策略* @param http security注入点* @return SecurityFilterChain* @throws Exception*/@BeanSecurityFilterChain defaultSecurityFilterChain(HttpSecurity http) throws Exception {http.authorizeHttpRequests(authorizeRequests ->authorizeRequests.requestMatchers("/token/*").permitAll()// 开放自定义的部分端点.anyRequest().authenticated());http.headers(header ->header.frameOptions(HeadersConfigurer.FrameOptionsConfig::sameOrigin)// 避免iframe同源无法登录许iframe);http.with(new FormIdentityLoginConfigurer(), Customizer.withDefaults()); // 表单登录个性化http.sessionManagement(sessionManagement -> sessionManagement.maximumSessions(1) // 限制同一个用户只能有一个会话.maxSessionsPreventsLogin(true) // 如果设置为true，当达到最大会话数时，拒绝新的登录);// 处理 UsernamePasswordAuthenticationTokenhttp.authenticationProvider(new MentalDaoAuthenticationProvider());return http.build();}/*** 暴露静态资源** https://github.com/spring-projects/spring-security/issues/10938* @param http* @return* @throws Exception*/@Bean@Order(0)SecurityFilterChain resources(HttpSecurity http) throws Exception {http.securityMatchers((matchers) -> matchers.requestMatchers("/actuator/**", "/css/**", "/error")).authorizeHttpRequests((authorize) -> authorize.anyRequest().permitAll()).requestCache(RequestCacheConfigurer::disable).securityContext(AbstractHttpConfigurer::disable).sessionManagement(AbstractHttpConfigurer::disable);return http.build();}}
2.在实现了OAuth2AuthorizationService的类中
package com.aiplus.mental.common.security.service;import lombok.RequiredArgsConstructor;
import lombok.extern.slf4j.Slf4j;
import org.springframework.data.redis.core.RedisTemplate;
import org.springframework.data.redis.serializer.RedisSerializer;
import org.springframework.lang.Nullable;
import org.springframework.security.oauth2.core.OAuth2AccessToken;
import org.springframework.security.oauth2.core.OAuth2RefreshToken;
import org.springframework.security.oauth2.core.endpoint.OAuth2ParameterNames;
import org.springframework.security.oauth2.server.authorization.OAuth2Authorization;
import org.springframework.security.oauth2.server.authorization.OAuth2AuthorizationCode;
import org.springframework.security.oauth2.server.authorization.OAuth2AuthorizationService;
import org.springframework.security.oauth2.server.authorization.OAuth2TokenType;
import org.springframework.util.Assert;import java.time.temporal.ChronoUnit;
import java.util.ArrayList;
import java.util.List;
import java.util.Objects;
import java.util.concurrent.TimeUnit;/*** @author lengleng* @date 2022/5/27*/
@Slf4j
@RequiredArgsConstructor
public class MentalRedisOAuth2AuthorizationService implements OAuth2AuthorizationService {private final static Long TIMEOUT = 10L;private static final String AUTHORIZATION = "token";private final RedisTemplate<String, Object> redisTemplate;@Overridepublic void save(OAuth2Authorization authorization) {Assert.notNull(authorization, "authorization cannot be null");if (isState(authorization)) {String token = authorization.getAttribute("state");redisTemplate.setValueSerializer(RedisSerializer.java());redisTemplate.opsForValue().set(buildKey(OAuth2ParameterNames.STATE, token), authorization, TIMEOUT, TimeUnit.MINUTES);}if (isCode(authorization)) {OAuth2Authorization.Token<OAuth2AuthorizationCode> authorizationCode = authorization.getToken(OAuth2AuthorizationCode.class);OAuth2AuthorizationCode authorizationCodeToken = authorizationCode.getToken();long between = ChronoUnit.MINUTES.between(authorizationCodeToken.getIssuedAt(),authorizationCodeToken.getExpiresAt());redisTemplate.setValueSerializer(RedisSerializer.java());redisTemplate.opsForValue().set(buildKey(OAuth2ParameterNames.CODE, authorizationCodeToken.getTokenValue()), authorization,between, TimeUnit.MINUTES);}if (isRefreshToken(authorization)) {OAuth2RefreshToken refreshToken = authorization.getRefreshToken().getToken();long between = ChronoUnit.SECONDS.between(refreshToken.getIssuedAt(), refreshToken.getExpiresAt());redisTemplate.setValueSerializer(RedisSerializer.java());redisTemplate.opsForValue().set(buildKey(OAuth2ParameterNames.REFRESH_TOKEN, refreshToken.getTokenValue()), authorization, between,TimeUnit.SECONDS);}if (isAccessToken(authorization)) {OAuth2AccessToken accessToken = authorization.getAccessToken().getToken();String userId = authorization.getPrincipalName();log.info("当前登录用户:{}",userId);// 1. 获取当前用户的旧tokenString oldTokenKey = (String) redisTemplate.opsForValue().get(AUTHORIZATION+userId);// 2. 移除旧token的授权信息if (oldTokenKey != null && !oldTokenKey.equals(accessToken.getTokenValue())) {redisTemplate.delete(buildKey(OAuth2ParameterNames.ACCESS_TOKEN, oldTokenKey));}// 3. 将新的 token 和用户ID关联存储redisTemplate.opsForValue().set(AUTHORIZATION+userId, accessToken.getTokenValue());long between = ChronoUnit.SECONDS.between(accessToken.getIssuedAt(), accessToken.getExpiresAt());redisTemplate.setValueSerializer(RedisSerializer.java());redisTemplate.opsForValue().set(buildKey(OAuth2ParameterNames.ACCESS_TOKEN, accessToken.getTokenValue()), authorization, between,TimeUnit.SECONDS);}}@Overridepublic void remove(OAuth2Authorization authorization) {Assert.notNull(authorization, "authorization cannot be null");List<String> keys = new ArrayList<>();if (isState(authorization)) {String token = authorization.getAttribute("state");keys.add(buildKey(OAuth2ParameterNames.STATE, token));}if (isCode(authorization)) {OAuth2Authorization.Token<OAuth2AuthorizationCode> authorizationCode = authorization.getToken(OAuth2AuthorizationCode.class);OAuth2AuthorizationCode authorizationCodeToken = authorizationCode.getToken();keys.add(buildKey(OAuth2ParameterNames.CODE, authorizationCodeToken.getTokenValue()));}if (isRefreshToken(authorization)) {OAuth2RefreshToken refreshToken = authorization.getRefreshToken().getToken();keys.add(buildKey(OAuth2ParameterNames.REFRESH_TOKEN, refreshToken.getTokenValue()));}if (isAccessToken(authorization)) {OAuth2AccessToken accessToken = authorization.getAccessToken().getToken();keys.add(buildKey(OAuth2ParameterNames.ACCESS_TOKEN, accessToken.getTokenValue()));}redisTemplate.delete(keys);}@Override@Nullablepublic OAuth2Authorization findById(String id) {throw new UnsupportedOperationException();}@Override@Nullablepublic OAuth2Authorization findByToken(String token, @Nullable OAuth2TokenType tokenType) {Assert.hasText(token, "token cannot be empty");Assert.notNull(tokenType, "tokenType cannot be empty");redisTemplate.setValueSerializer(RedisSerializer.java());return (OAuth2Authorization) redisTemplate.opsForValue().get(buildKey(tokenType.getValue(), token));}private String buildKey(String type, String id) {return String.format("%s::%s::%s", AUTHORIZATION, type, id);}private static boolean isState(OAuth2Authorization authorization) {return Objects.nonNull(authorization.getAttribute("state"));}private static boolean isCode(OAuth2Authorization authorization) {OAuth2Authorization.Token<OAuth2AuthorizationCode> authorizationCode = authorization.getToken(OAuth2AuthorizationCode.class);return Objects.nonNull(authorizationCode);}private static boolean isRefreshToken(OAuth2Authorization authorization) {return Objects.nonNull(authorization.getRefreshToken());}private static boolean isAccessToken(OAuth2Authorization authorization) {return Objects.nonNull(authorization.getAccessToken());}}
